ZeroDay Findings
Sign inSign up

Findings

CVE-2018-0175

Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

Published Mar 28, 2018 · updated Jun 16, 2026 · cisco ios

Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 28, 2018 · Catalog

    Detected

    Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

  2. Mar 3, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 17, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

Required action

Apply updates per vendor instructions.

CISA due date Mar 17, 2022

Affected

  • cpe cisco/iosversion unspecified
  • cpe cisco/ios15.4\(3\)m4.1
  • cpe cisco/ios xeversion unspecified
  • cpe cisco/ios xe15.4\(3\)m4.1
  • cpe cisco/ios xr15.4\(3\)m4.1
  • vendor Cisco IOS, XR, and XE Softwareversion unspecified

Sources

  • CISA KEVCVE-2018-0175

    Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.

    cisa.gov
  • CVE.orgCVE-2018-0175

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-0175

    30-day exploitation probability 3.5%

    first.org
  • NIST NVDCVE-2018-0175

    Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with

    nvd.nist.gov

References